CVE-2022-1551: SP Project & Document Manager < 4.58 - Sensitive File Disclosure

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.0% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2022-07-25 · updated 2026-06-17
Weakness: CWE-425

Description

The SP Project & Document Manager WordPress plugin before 4.58 uses an easily guessable path to store user files, bad actors could use that to access other users' sensitive files.

Affected products

Smartypants SP Project & Document Manager: before 4.58 — fixed in 4.58

How to fix

Upgrade to a fixed version: Smartypants SP Project & Document Manager 4.58. Check the vendor advisory for mitigations.

References

https://wpscan.com/vulnerability/51b4752a-7922-444d-a022-f1c7159b5d84
https://wpscan.com/vulnerability/51b4752a-7922-444d-a022-f1c7159b5d84

Get alerted when CVE-2022-1551 or the next vulnerability affects your stack